LILiK
/
openwrt-packages-dist


								# Kismet config file

								# Most of the "static" configs have been moved to here -- the command line

								# config was getting way too crowded and cryptic.  We want functionality,

								# not continually reading --help!


								# Version of Kismet config

								version=2009-newcore


								# Name of server (Purely for organizational purposes)

								# If commented out, defaults to host name of system

								# servername=Kismet Server


								# Prefix of where we log (as used in the logtemplate later)

								logprefix=/tmp


								# Do we process the contents of data frames?  If this is enabled, data

								# frames will be truncated to the headers only immediately after frame type

								# detection.  This will disable IP detection, etc, however it is likely

								# safer (and definitely more polite) if monitoring networks you do not own.

								# hidedata=true


								# Do we allow plugins to be used?  This will load plugins from the system

								# and user plugin directiories when set to true (See the README for the default

								# plugin locations).

								allowplugins=false


								# See the README for full information on the new source format

								# ncsource=interface:options

								# for example:

								# ncsource=wifi0:type=madwifi

								# ncsource=wlan0:name=intel,hop=false,channel=11

								ncsource=wlan0


								# Comma-separated list of sources to enable.  This is only needed if you defined

								# multiple sources and only want to enable some of them.  By default, all defined

								# sources are enabled.

								# For example, if sources with name=prismsource and name=ciscosource are defined,

								# and you only want to enable those two:

								# enablesources=prismsource,ciscosource


								# Control which channels we like to spend more time on.  By default, the list

								# of channels is pulled from the driver automatically.  By setting preferred channels,

								# if they are present in the channel list, they'll be set with a timing delay so that

								# more time is spent on them.  Since 1, 6, 11 are the common default channels, it makes

								# sense to spend more time monitoring them.

								# For finer control, see further down in the config for the channellist= directives.

								preferredchannels=1,6,11


								# How many channels per second do we hop?  (1-10)

								channelvelocity=3


								# By setting the dwell time for channel hopping we override the channelvelocity

								# setting above and dwell on each channel for the given number of seconds.

								#channeldwell=10


								# Channels are defined as:

								# channellist=name:ch1,ch2,ch3

								# or

								# channellist=name:range-start-end-width-offset,ch,range,ch,...

								#

								# Channels may be a numeric channel or a frequency

								#

								# Channels may specify an additional wait period.  For common default channels,

								# an additional wait period can be useful.  Wait periods delay for that number

								# of times per second - so a configuration hopping 10 times per second with a

								# channel of 6:3 would delay 3/10ths of a second on channel 6.

								#

								# Channel lists may have up to 256 channels and ranges (combined).  For power

								# users scanning more than 256 channels with a single card, ranges must be used.

								#

								# Ranges are meant for "power users" who wish to define a very large number of

								# channels.  A range may specify channels or frequencies, and will automatically

								# sort themselves to cover channels in a non-overlapping fashion.  An example

								# range for the normal 802.11b/g spectrum would be:

								#

								# range-1-11-3-1

								#

								# which indicates starting at 1, ending at 11, a channel width of 3 channels,

								# incrementing by one.  A frequency based definition would be:

								#

								# range-2412-2462-22-5

								#

								# since 11g channels are 22 mhz wide and 5 mhz apart.

								#

								# Ranges have the flaw that they cannot be shared between sources in a non-overlapping

								# way, so multiple sources using the same range may hop in lockstep with each other

								# and duplicate the coverage.

								#

								# channellist=demo:1:3,6:3,11:3,range-5000-6000-20-10


								# Default channel lists

								# These channel lists MUST BE PRESENT for Kismet to work properly.  While it is

								# possible to change these, it is not recommended.  These are used when the supported

								# channel list can not be found for the source; to force using these instead of

								# the detected supported channels, override with channellist= in the source definition

								#

								# IN GENERAL, if you think you want to modify these, what you REALLY want to do is

								# copy them and use channellist= in the packet source.

								channellist=IEEE80211b:1:3,6:3,11:3,2,7,3,8,4,9,5,10

								channellist=IEEE80211a:36,40,44,48,52,56,60,64,149,153,157,161,165

								channellist=IEEE80211ab:1:3,6:3,11:3,2,7,3,8,4,9,5,10,36,40,44,48,52,56,60,64,149,153,157,161,165


								# Client/server listen config

								listen=tcp://127.0.0.1:2501

								#listen=tcp://0.0.0.0:2501


								# People allowed to connect, comma separated IP addresses or network/mask

								# blocks.  Netmasks can be expressed as dotted quad (/255.255.255.0) or as

								# numbers (/24)

								allowedhosts=127.0.0.1

								# Maximum number of concurrent GUI's

								maxclients=5

								# Maximum backlog before we start throwing out or killing clients.  The

								# bigger this number, the more memory and the more power it will use.

								maxbacklog=5000


								# Server + Drone config options.  To have a Kismet server export live packets

								# as if it were a drone, uncomment these.

								# dronelisten=tcp://127.0.0.1:3501

								# droneallowedhosts=127.0.0.1

								# dronemaxclients=5

								# droneringlen=65535


								# OUI file, expected format 00:11:22<tab>manufname

								# IEEE OUI file used to look up manufacturer info.  We default to the

								# wireshark one since most people have that.

								#ouifile=/usr/share/manuf


								# Do we have a GPS?

								gps=false

								# Do we use a locally serial attached GPS, or use a gpsd server, or

								# use a fixed virtual gps?

								# (Pick only one)

								gpstype=gpsd

								# Host:port that GPSD is running on.  This can be localhost OR remote!

								gpshost=localhost:2947


								# gpstype=serial

								# What serial device do we look for the GPS on?

								# gpsdevice=/dev/rfcomm0


								# gpstype=virtual

								# gpsposition=100,-50

								# gpsaltitude=1234


								# Do we lock the mode?  This overrides coordinates of lock "0", which will

								# generate some bad information until you get a GPS lock, but it will

								# fix problems with GPS units with broken NMEA that report lock 0

								gpsmodelock=false

								# Do we try to reconnect if we lose our link to the GPS, or do we just

								# let it die and be disabled?

								gpsreconnect=true


								# Do we export packets over tun/tap virtual interfaces?

								tuntap_export=false

								# What virtual interface do we use

								tuntap_device=kistap0


								# Packet filtering options:

								# filter_tracker - Packets filtered from the tracker are not processed or

								#                  recorded in any way.

								# filter_export  - Controls what packets influence the exported CSV, network,

								#                  xml, gps, etc files.

								# All filtering options take arguments containing the type of address and

								# addresses to be filtered.  Valid address types are 'ANY', 'BSSID',

								# 'SOURCE', and 'DEST'.  Filtering can be inverted by the use of '!' before

								# the address.  For example,

								# filter_tracker=ANY(!"00:00:DE:AD:BE:EF")

								# has the same effect as the previous mac_filter config file option.

								# filter_tracker=...

								# filter_dump=...

								# filter_export=...

								# filter_netclient=...


								# Alerts to be reported and the throttling rates.

								# alert=name,throttle/unit,burst

								# The throttle/unit describes the number of alerts of this type that are

								# sent per time unit.  Valid time units are second, minute, hour, and day.

								# Burst describes the number of alerts sent before throttling takes place.

								# For example:

								# alert=FOO,10/min,5

								# Would allow 5 alerts through before throttling is enabled, and will then

								# limit the number of alerts to 10 per minute.

								# A throttle rate of 0 disables throttling of the alert.

								# See the README for a list of alert types.

								alert=ADHOCCONFLICT,5/min,1/sec

								alert=AIRJACKSSID,5/min,1/sec

								alert=APSPOOF,10/min,1/sec

								alert=BCASTDISCON,5/min,2/sec

								alert=BSSTIMESTAMP,5/min,1/sec

								alert=CHANCHANGE,5/min,1/sec

								alert=CRYPTODROP,5/min,1/sec

								alert=DISASSOCTRAFFIC,10/min,1/sec

								alert=DEAUTHFLOOD,5/min,2/sec

								alert=DEAUTHCODEINVALID,5/min,1/sec

								alert=DISCONCODEINVALID,5/min,1/sec

								alert=DHCPNAMECHANGE,5/min,1/sec

								alert=DHCPOSCHANGE,5/min,1/sec

								alert=DHCPCLIENTID,5/min,1/sec

								alert=DHCPCONFLICT,10/min,1/sec

								alert=NETSTUMBLER,5/min,1/sec

								alert=LUCENTTEST,5/min,1/sec

								alert=LONGSSID,5/min,1/sec

								alert=MSFBCOMSSID,5/min,1/sec

								alert=MSFDLINKRATE,5/min,1/sec

								alert=MSFNETGEARBEACON,5/min,1/sec

								alert=NULLPROBERESP,5/min,1/sec

								alert=PROBENOJOIN,5/min,1/sec


								# Controls behavior of the APSPOOF alert.  SSID may be a literal match (ssid=) or

								# a regex (ssidregex=) if PCRE was available when kismet was built.  The allowed

								# MAC list must be comma-separated and enclosed in quotes if there are multiple

								# MAC addresses allowed.  MAC address masks are allowed.

								#apspoof=Foo1:ssidregex="(?i:foobar)",validmacs=00:11:22:33:44:55

								#apspoof=Foo2:ssid="Foobar",validmacs="00:11:22:33:44:55,aa:bb:cc:dd:ee:ff"


								# Known WEP keys to decrypt, bssid,hexkey.  This is only for networks where

								# the keys are already known, and it may impact throughput on slower hardware.

								# Multiple wepkey lines may be used for multiple BSSIDs.

								# wepkey=00:DE:AD:C0:DE:00,FEEDFACEDEADBEEF01020304050607080900


								# Is transmission of the keys to the client allowed?  This may be a security

								# risk for some.  If you disable this, you will not be able to query keys from

								# a client.

								allowkeytransmit=true


								# How often (in seconds) do we write all our data files (0 to disable)

								writeinterval=10


								# Do we use sound?

								# Not to be confused with GUI sound parameter, this controls wether or not the

								# server itself will play sound.  Primarily for headless or automated systems.

								enablesound=false

								# Path to sound player

								soundbin=play


								sound=newnet,true

								sound=newcryptnet,true

								sound=packet,true

								sound=gpslock,true

								sound=gpslost,true

								sound=alert,true


								# Does the server have speech? (Again, not to be confused with the GUI's speech)

								enablespeech=false

								# Binary used for speech (if not in path, full path must be specified)

								speechbin=flite

								# Specify raw or festival; Flite (and anything else that doesn't need formatting

								# around the string to speak) is 'raw', festival requires the string be wrapped in

								# SayText("...")

								speechtype=raw


								# How do we speak?  Valid options:

								# speech    Normal speech

								# nato      NATO spellings (alpha, bravo, charlie)

								# spell     Spell the letters out (aye, bee, sea)

								speechencoding=nato


								speech=new,"New network detected s.s.i.d. %1 channel %2"

								speech=alert,"Alert %1"

								speech=gpslost,"G.P.S. signal lost"

								speech=gpslock,"G.P.S. signal O.K."


								# How many alerts do we backlog for new clients?  Only change this if you have

								# a -very- low memory system and need those extra bytes, or if you have a high

								# memory system and a huge number of alert conditions.

								alertbacklog=50


								# File types to log, comma separated.  Built-in log file types:

								# alert				Text file of alerts

								# gpsxml			XML per-packet GPS log

								# nettxt			Networks in text format

								# netxml			Networks in XML format

								# pcapdump			tcpdump/wireshark compatible pcap log file

								# string			All strings seen (increases CPU load)

								logtypes=pcapdump,gpsxml,netxml,alert


								# Format of the pcap dump (PPI or 80211)

								pcapdumpformat=ppi

								# pcapdumpformat=80211


								# Default log title

								logdefault=Kismet


								# logtemplate - Filename logging template.

								# This is, at first glance, really nasty and ugly, but you'll hardly ever

								# have to touch it so don't complain too much.

								#

								# %p is replaced by the logging prefix + '/'

								# %n is replaced by the logging instance name

								# %d is replaced by the starting date as Mon-DD-YYYY

								# %D is replaced by the current date as YYYYMMDD

								# %t is replaced by the starting time as HH-MM-SS

								# %i is replaced by the increment log in the case of multiple logs

								# %l is replaced by the log type (pcapdump, strings, etc)

								# %h is replaced by the home directory


								logtemplate=%p%n-%D-%t-%i.%l


								# Where state info, etc, is stored.  You shouldn't ever need to change this.

								# This is a directory.

								configdir=%h/.kismet/